Yazapage,
it seems like the "splunkd" windows services is stuck in an un-deterministic state. Fist of all once Splunk is running as a Local System user, all of the files created at run time will be owned by that user. Switching to a Domain user account it will not do any good. I suggest you switch both services, including splunkweb back to Local System User again.
As far as the splunkd service, you may need to reboot the machine for Windows Service manager to release that service. Once the machines comes backup online again, the services manager will have deleted the service, and you'll need to create another one.
As far as splunkweb, just open service manager and tell splunkweb service to run as Local System user.
Since splunkd service is delete now, to created again open a terminal and go to Splunk home bin directory, eg:
cd c:\Program Files\Splunk\bin
From there run:
splunk enable boot-start
This command will try and create both services, splunkd and splunkweb allover again.
Start splunk:
splunk start
Let us know how it goes.
Thanks,
Ledio
... View more